Git版本管理工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.2

Overview

This is mostly a Git reference skill, but it asks agents to perform broad and sometimes destructive repository actions while declaring only read access.

Review before installing. This skill appears to be Git workflow guidance rather than malware, but use it only where the agent must ask before running Git commands. Be especially careful with reset --hard, clean -fdx, force pushes, remote branch or tag deletion, and any request to configure API keys or hosting credentials.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest declares only the read tool, but the body claims the skill can create files, write data, and execute commands. That tool/capability mismatch is dangerous because it can mislead the orchestration layer or user into authorizing actions the skill is not declared to perform, undermining least-privilege guarantees.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Q2: 如何回退最近一次提交？
A: 若尚未推送，使用 `git reset --soft HEAD~1` 回退但保留变更在工作区；若已推送且希望反向提交，使用 `git revert HEAD` 生成一次撤销提交，避免改写公共历史。
### Q3: 如何删除远程分支？
A: 执行 `git push origin --delete branch-name` 删除远程分支，本地分支用 `git branch -d branch-name` 清理。删除前确认无协作者依赖该分支。
### Q4: 何时使用 force-with-lease 而非 force？
A: 推荐始终使用 `git push --force-with-lease`。它会在远程有他人新提交时拒绝推送，避免覆盖他人工作；而 `--force` 会无条件覆盖，仅适合个人独占分支。
### Q5: 如何撤销已推送的提交？

• Confidence: 94% confidence
• Finding: This duplicate finding points to the same remote deletion/force-push guidance. The risk remains real because parameterized destructive Git commands are being normalized in a skill that may be invoked automatically or followed verbatim by users.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Q2: 如何回退最近一次提交?
A: 若尚未推送,使用 `git reset --soft HEAD~1` 回退但保留变更在工作区;若已推送且希望反向提交,使用 `git revert HEAD` 生成一次撤销提交,避免改写公共历史。
### Q3: 如何删除远程分支?
A: 执行 `git push origin --delete branch-name` 删除远程分支,本地分支用 `git branch -d branch-name` 清理。删除前确认无协作者依赖该分支。
### Q4: 何时使用 force-with-lease 而非 force?
A: 推荐始终使用 `git push --force-with-lease`。它会在远程有他人新提交时拒绝推送,避免覆盖他人工作;而 `--force` 会无条件覆盖,仅适合个人独占分支。
### Q5: 如何撤销已推送的提交?

• Confidence: 94% confidence
• Finding: This duplicate finding points to the same remote deletion/force-push guidance. The risk remains real because parameterized destructive Git commands are being normalized in a skill that may be invoked automatically or followed verbatim by users.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Q4: 何时使用 force-with-lease 而非 force？
A: 推荐始终使用 `git push --force-with-lease`。它会在远程有他人新提交时拒绝推送，避免覆盖他人工作；而 `--force` 会无条件覆盖，仅适合个人独占分支。
### Q5: 如何撤销已推送的提交？
A: 已推送至共享分支的提交，使用 `git revert commit-hash` 生成反向提交再推送；仅在个人独占分支才可考虑 `git reset --hard` 后强制推送。
### Q6: 如何合并多个提交为一个？
A: 执行 `git rebase -i HEAD~3` 进入交互式变基，将后续提交标记为 `squash` 或 `fixup`，保存后编辑合并信息，完成后 `git push --force-with-lease` 更新远程。
### Q7: 如何恢复误删的分支？

• Confidence: 96% confidence
• Finding: The FAQ discusses using git reset --hard followed by force pushing on personal branches. Even if framed as conditional advice, this is a destructive sequence that can permanently discard local changes and, if misapplied, overwrite remote history; in an agent skill, that makes misuse more dangerous than in passive reference material.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

git fetch origin
git pull
git pull --rebase
git push
git push -u origin branch-name
git push --force-with-lease
```

• Confidence: 92% confidence
• Finding: This duplicate finding points to the same push and force-with-lease examples in the remote sync section. The danger comes from state-changing remote operations being suggested without verifying target branch, remote, and user intent.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

git fetch origin
git pull
git pull --rebase
git push
git push -u origin branch-name
git push --force-with-lease
```

• Confidence: 92% confidence
• Finding: This duplicate finding points to the same push and force-with-lease examples in the remote sync section. The danger comes from state-changing remote operations being suggested without verifying target branch, remote, and user intent.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

回退或撤销已生成的提交。
```bash
git reset --soft HEAD~1
git reset --hard HEAD~1
git revert commit-hash
git reset --hard commit-hash
```

• Confidence: 97% confidence
• Finding: The commit rollback section lists git reset --hard HEAD~1, a command that irreversibly discards working tree and index changes. In this skill context, presenting it as a standard rollback option without mandatory safeguards increases the chance of accidental data loss.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

git reset --soft HEAD~1
git reset --hard HEAD~1
git revert commit-hash
git reset --hard commit-hash
```
## 储藏工作区
临时保存未完成变更，便于切换上下文。

• Confidence: 97% confidence
• Finding: The example git reset --hard commit-hash can rewind the repository to an arbitrary commit and discard current state. Because the skill is meant to operationalize Git workflows, exposing this command without strong safeguards materially raises the risk of irreversible local loss and later unsafe force-pushes.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

git clean -n
git clean -f
git clean -fd
git clean -fdx
```
## 常用工作流
特性分支工作流：

• Confidence: 95% confidence
• Finding: git clean -fdx deletes all untracked files, directories, and ignored files, which commonly includes local configs and build artifacts that may be unrecoverable. In an agent-assisted skill, recommending this command without strict preview/confirmation is a significant destructive-operation hazard.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The description states that the skill '将说明文字中文化' and presents the skill as localized to Chinese, but it does not offer opt-in or alternative language behavior. This can violate language/locale policy when users may expect responses in their preferred language.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are extremely broad, covering common words like 'git', 'push', 'pull', and ordinary software-collaboration topics. In an agent environment, that increases accidental activation risk and may cause the skill to intervene or recommend impactful repository operations in unrelated contexts.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The capability-boundary section says hooks/script development is unsupported, yet later sections advertise broader file handling, API integration, and command execution capabilities beyond a Git reference skill. This mismatch expands the apparent authority of the skill and can lead an agent or user to over-trust it for operations outside its declared scope.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents destructive commands such as hard reset, force push, remote branch deletion, and aggressive clean operations without consistently requiring explicit warnings, backups, or confirmation gates. In a skill intended to guide or drive agent actions, this creates a real risk of irreversible code loss or repository history rewrite.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The documentation gives conflicting guidance about whether credentials are required: one section says no extra API key is needed, while nearby guidance says API keys or platform access credentials must be configured. In an agent setting, such inconsistency can cause unsafe operator behavior, such as prompting users for unnecessary secrets or mishandling authentication assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: A Git essentials reference skill advertises generic external API integration capabilities that are not justified by its purpose. Unnecessary external integration broadens the attack surface by normalizing outbound actions and secret handling unrelated to basic Git assistance.

Static analysis

No suspicious patterns detected.